Security Tube Python Scripting Expert - debugging

Question

I'm currently doing a python course through Security Tube. I've currently got stuck on one module where I have to run a Python script through XP and execute it through Immunity Debugger with a process in front of it.
Here's the code:
#!/usr/bin/python2.7
import immlib
DESC="Find Instructions"
def main(args) :
imm = immlib.Debugger()
assembledInstruction = imm.assemble (' ' .join(args))
if not assembledInstruction :
return "[-] No Instruction Given!"
addressList = imm.search(assembledInstruction)
td = imm.createTable("Instruction Locations", ['Module', 'Base Address', 'Instruction Address', 'Instruction']
for address in addressList :
# Get module for this address
module = imm.findModule(address)
if not module:
imm.log("Address 0x%08X not in any module" %address)
# Get module object by name. Please note we are not checking for page properties.
# exercises? :)
instruction = ''
numArgs = len(' '.join(args).split('\n'))
for count in range(0, numArgs) :
instruction += imm.disasmForward(address, nlines=count).getDisasm() + ''
td.add(0, [ module[0],
str('0x%08X'%module[1])
str('0x%08X'%address),
instruction
])
I've saved the .py file as spse-find.py. From there I log on to my XP through Virtual Box, open Immunity Debugger, execute Server-strcpy.exe. At the bottom of the program, I type in:
!spse-find jmp ecp
But upon this being executed I receive the following error:
pycommands: error importing module.
I've placed this in the Security Tube forums but the only thing which I've been told is that I should check the code syntax to ensure it's correct and to ensure that I'm following the video correctly. I've made the checks at least 4 or 5 times. I haven't received any further replies from them since that and so I was wondering if anyone would be able to provide me with any further insight to where I've gone wrong or where more code needs to be added.

Answer 1

Running your code, I get a SyntaxError:
C:\Users\kevin>test.py
File "C:\Users\kevin\test.py", line 20
for address in addressList :
^
SyntaxError: invalid syntax
This message is misleading, because that line is error-free. But sometimes the reported line number is off by one, so let's look at the previous line:
td = imm.createTable("Instruction Locations", ['Module', 'Base Address', 'Instruction Address', 'Instruction']
This is a syntax error. You are missing a closing parenthesis. It should be:
td = imm.createTable("Instruction Locations", ['Module', 'Base Address', 'Instruction Address', 'Instruction'])
Running the program again, we get:
C:\Users\kevin>test.py
File "C:\Users\kevin\test.py", line 38
str('0x%08X'%address),
^
SyntaxError: invalid syntax
This is another red herring. You forgot a comma on line 37.
str('0x%08X'%module[1])
Should be
str('0x%08X'%module[1]),
That should fix all of your syntax errors. (I can't vouch for the correctness of the program at run time, however, since I don't have the immlib library.)

Answer 2

Using immunity debugger is complicated to find out what is going on. The best way is calling the pycommand without the .py extension. That is, if your pycommand is correctly placed under the PyCommands folder and it is called "example.py", using the command bar at the bottom of the grafical interface you should call the pycommand in this way: !example --> instead of !example.py. The second option will compile the code and just tell you something is wrong, the first one will parse the content and tell you the line which is causing the script to fail.
I hope it helps.
Regards.